Apache Zeppelin: LDAP search filter query Injection Vulnerability

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2024-31867 · ADVISORY
• apache/zeppelin#4714 · WEB
• apache/zeppelin commit 65d0bcc · WEB
• apache/zeppelin · PACKAGE
• lists.apache.org/thread/s4scw8bxdhrjs0kg0lhb68xqd8y9lrtf · WEB
• openwall.com/lists/oss-security/2024/04/09/12 · WEB

org.apache.zeppelin:zeppelin-server のその他の脆弱性

• CVE-2024-41169高 7.5The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources, including directories …
• CVE-2024-31865中 6.5Improper Input Validation vulnerability in Apache Zeppelin. The attackers can call updating cron API with invalid or improper privileges so…
• CVE-2024-31863中 5.3Authentication Bypass by Spoofing vulnerability by replacing to exsiting notes in Apache Zeppelin.This issue affects Apache Zeppelin: from 0…
• CVE-2024-31862中 5.3Improper Input Validation vulnerability in Apache Zeppelin when creating a new note from Zeppelin's UI.This issue affects Apache Zeppelin: f…
• CVE-2024-31860中 6.5Improper Input Validation vulnerability in Apache Zeppelin. By adding relative path indicators(E.g ..), attackers can see the contents for …